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REMARKS 

The Examiner has maintained the rejection of the claims. As set forth below, 
such tejection is still deficient. Howeveff, despite such deficiencies and in the spirit of 
expediting the prosecution of the present appHcation, applicant has incorporated the 
subject matter of at least one dependent claim into each of the independent claims. Since 
the subject matter of such dependent claim(s) was already considered by the Examiner, it 
is asserted that such claim amendments would not require new search and/or 
consideration. 

the Examiner has rejected Claims 1-2, 4-1 1, and 13-20 under 35 U,S-C. 103(a) as 
b^ixxg unpatentable overNachenberg (U.S. Patent No. 6,357,008) in view of Serbinis et 
ai. (U.S. Patent No. 6>3 14,425). Apphcant respectfully disagrees with such rejection, 
especially in view of the amendments made hereinabove to each of the independent 
claims. Specifically, applicant has amended each of the independent claims to at least 
substiantially include the subject matter of former dependent Claims 2 and 6 et al. 

With respect to each of the independent claims^ the Examiner has relied on the 
following excerpts firom the Nachenberg reference to make a prior art showing of 
apphcant' s claimed "Structured virus database storing one or more virus definition 
records" (see this ot similar, but not necessarily identical language in each of the 
independent claims). 

""Signature scanning antivirus programs work by scanning files for 
signatures of known vir-uses. A signature is a sequence of bytes 
that tnay be fo\md in a virus program code, yet is unlikely to be 
found elsewhere. To "extract" a signature, an antivirus 
researcher must analyze the virus. Once this signature is 
determined, it is recorded in a database of virus signatures to 
be used by an antivirus program." (Col. l, lines 27-33) 

.positive" rate if properly implemented. However, only viruses 
whose signatures have already been determined and stored in the 
signature database may be detected using signature scanning. 
Moreover, the signature database must be updated £recfuently to 
detect the latest viruses," (col. 1, lines 42-45) 
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The Nachenberg reference teaches a database of virus signatures . Applicant, 
hdwever, claims a " gtructured virus database storing one or more virus definition 
records " (eiliphasis added). These definition records claimed by applicant fijrther 
comprise at least an identifier, virus name, and virus definition, and removal sentences, 
wliereas the Nachenberg^s virus signatures merely consist of "a sequence of bytes that 
may be found in a virus program code, yet is unlikely to be found elsewhere" (Col.l, 
lines 28-30). As a result, applicant's claims are clearly distinct. 

Additionally, with respect to each of the independent claims, the Examiner has 
relied on the folloxving excerpt fix)m the Nachenberg reference to make a prior art 
showing of appUcant^s claimed "at least one virus name associated with the computer 
virus" (see this or similar, but not necessarily identical language in each of the 
independent claims). 

designed to be specific to a single virus. Instead, they are 
mecint to be as general as possible in order to detect the 
opei-ation of many different viruses." (Col, 2, lines 43-45) 

The above reference teaches tJie searching of a target program for sequences of 
iostnictjons not gpecific to a specific virus . This is completely unrelated to appUcant*s 
claimed ''at least one virus name associated with the computer virus" (emphasis added). 
Additionally, it is stated in the Nachenberg reference that the sequences of instructions 
are *hlfilike [the] vims signatures" described earlier (Col.2, line 42). Thus, even if 
applicant's claimed virus name were to be eq\iated to Nachenberg^s sequences of 
instructions, it is impossible, in Nachenberg, for a database of virus signatures to contain 
the sequences of instructions, as they were contrasted in the reference. Since applicant's 
claimed virus name is not found in Nachenberg, and is also a component of applicant's 
claimed virus definition record, it is clearly distinct. 

Furthennore, with tespect to each of the ^dependent claims, the Examiner has 
relied on the following excerpt fix>m the Nachenberg reference to make a prior art 
showing of applicant's claimed "virus removal sentence comprising object code 



PAGE 12/16 * RCVD AT 3/20/2008 5:10:59 PM [Eastern Stajidanl fime)* SVR:USPT0£FXRF-1/18 * DN1S:2738300* CSID:4089714660^ DURATION (nim-ss):04-10 



MAR. 20. 2006 2:24PM ZILKA-KOTAB, PC 

-10- 



Na 2293 P. 13 



providing operations to clean the identified computer vims from the computer system" 
(see this or similar, but not necessarily idratical language in each of the independent 
claims). 

signature sc&jming antivirus program qan identify particular 
virus strains for removal and may have a low "false-positive" 
rate if properly implemented. However, only,.,'' (Col. 1, lines 
39-41) 

The above reference teaches the identification of virus strains for removal. 
Applicant's claim, however, requires the actual "object code providing operations to 
clean the identified computet virus from the computer system" (emphasis added). Since 
the reference only teaches the identification of viruses for removal and does not provide 
any operations for such cleaning, applicant's claim is clearly distinct. 

To establish sl prima facie case of obviousness, three basic criteria must be met. 
First, thete must be some suggestion or motivation, either in the references themselves or 
in ttie knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Fmally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Va&ch947 F.2d 488, 20 USPQ2d 
1438 (FedCir. 1991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met^ since the prior art references, when combined, fail 
to teach or suggest al) of the claim limitations, as noted above. Nevertheless, despite 
such paramount deficiencies and in the spirit of expediting the prosecution of the present 
application, applicant has amended each of the uidependent claims to fiirther distinguish 
applicant*s claim language from the above reference, as follows: 
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"converting each vims definition set in the virus data file into a vims 
definition recotd"; ajEid 

"accessing the virus definition records in the structured virus database to 
perform at least one of adding, removing, and replacing a virus definition record" 
(see these or similar, but not necessarily identical language in each of the 
independent claims). 



With respect to the subject matter of former Claim 2 (now at least substantially 
incorporated into each of the independent claims), the Examiner has relied on the 
following excerpts fit>m the Nachenberg reference to make a prior ait showing of 
apphcant's claimed client anti-vixus language decompiler for "converting each vims 
definition set in the virus data file into a virus definition record" (see this or similar, but 
not necessarily identical language in each of the independent claims). 



"Non- integrity -based (also called "heuristic") uiLknown vims 
detection is used to detect new and unknown viruses without any 
iintegxity informatioxi. A heuristic antivirus program exacninee a 
target program (executable file, boot record, or possibly 
document file with sl macro) and analyzes its program code to 
determine if the code appears virus-like. If the target program's 
code appears virus -like, then the possible infection is reported 
to the user," (col. 2, lines 18-25) 

*A signature scanning antivirus program can identify particular 
virus strains for removal and Toay have a low "false-positive'* 
rate if properly implemented. However, only viruses whose 
signatures have already been determined and stored in the 
signature database may be detected using signature scanning. 
Moreover, the signature database must be updated frequently to 
detect the latest viruses." (Col. 1, lines 39-45) 



The above exceipt from Nachenberg teaches the analysis of program code to 
detennine if it appears vims-like, as well as signatnre scaiming of a frequently updated 
signature database. On the other hand, applicant's claim requires the conversion of a 
yirUiS deftnition set comprising binary data coding instructions to detect and clean 
cotirputer viruses, into a vims definition record, comprising an identifier, at least one 
vims name, and vims defini tioa and removal sentences, all of which are not mentioned 
in the prior art, when taken in combination as claimed. The analysis of code and the 
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scanning of a signature database of Nacheriberg simply does not meet applicant's claimed 
conversion of binary data coding instmctions into an identifier, at least one virus name, 
and virus definition and removal sentences. As a result, applicant's claim is clearly 
distinct. 



Additionally, with respect to the subject matter of former Claim 6 (now at least 
substantially incorporated into each of the independent claims), the Examiner has relied 
on the following excerpts &om the Nachenberg reference to make a prior art showing of 
appUcanfs claimed database engine for "accessing the virus definition records in the 
stmchn-ed virus database to p&rfoim at least one of adding, removing, and replacing a 
vims definition record," (see this or similar, but not necessarily identical language m each 
Of the independent claims). 

"signature scanniftg. Moreover, the signature database must be 
updated frequently to detect the latest viruses." (Col. l. lines 
44-45} 

The above reference teaches the ufedating of a signature database. la contrast, 
aiipUcant's claim requires accessing the virus definition records in the structured virus 
database in order to perform at least one of adding, removing, and replacme a virus 
definition record . Also, as mentioned above, a virus definition recnrH differs greatly fiom 
the above reference's virus signature. As a result, apphcant's claims are clearly distinct. 

Again, ^plicant respectfiilly asserts that at least the third element of the;7n«o 
facie case of obviousness has not been met, since the prior art references, when 
combined, fail to teach or suggest all of the claim Umitations, as noted above. Thus, a 
notice of aUowance or specific prior ait showing of each of the foregomg claim elements, 
in combination with the remaining claimed features, is respectfiilly reijuested. 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such indep«ident claims. 
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In the event a telephone conversation would expedite the prosecution of this 
application, the Examinermay reach the undersigned at (408) 505-5100, The 
Commissioner is authorized to chafge any additional fees or credit any oveipaymeot to 
Deposit Account No. 50-1351 (Order No. NAnP376/00. 140.01). 



P.O. Box 721120 

San Jose, CA 95172-1 120 

40S-505-5100 
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